Security risk and defensive technology of Edge IoT agent based on SDN

doi:10.3969/j.issn.1674-1951.2021.03.004

Abstract

Abstract:

：During the development from the era of internet to the era of Internet of Things（IoT）,the emerging IoT is challenged on its scalability and security.On the one hand,the storage and computing capacities of IoT devices are limited,while the external assistance provided by edge cloud and edge computing is expected to enhance the scalability of the IoT.On the other hand,constrained by current resources,IoT devices can hardly resist malicious attacks.Aiming at these challenges,the security risk of Edge IoT agent based on Software Defined Network（SDN） is studies,and the latest research results of network intrusion detection and defense based on SDN network are analyzed.

Key words: agent of Edge IoT, Software Defined Network, security risk, defense technology, network intrusion detection, Internet of Things（IoT）, edging computing

CLC Number:

TK01 ⁺8：TP13

HAN Jian, LIU Song, WEI Yinwu, LI Bin, QI Bing. Security risk and defensive technology of Edge IoT agent based on SDN[J]. Huadian Technology, 2021, 43(3): 20-24.

Figures/Tables 4

References 24

[1]	RAFIQUE W, QI L Y, YAQOOB I , et al. Complementing IoT services through software defined networking and edge computing:A comprehensive survey[J]. IEEE Communications Surveys & Tutorials, 2020,22(3):1761-1804.
[2]	MEI L, TONG H J, LIU T, et al. PSA:An architecture for proactively securing protocol-oblivious SDN networks[C]// IEEE International Conference on Electronics Information and Emergency Communication,Beijing, 2019: 1-6.
[3]	雷家星, 胡洋 .基于OpenFlow的SDN安全漏洞与防御的研究[J]. 内江科技, 2020, 41(8): 30, 33-34.
[4]	YANG L X, HUANG K F, YANG X F , et al. Defense against advanced persistent threat through data backup and recovery[J]. IEEE Transactions on Network Science and Engineering, 2020.DOI: 10.1109/TNSE.2020.3040247. doi: 10.1109/TNSE.2016.2537545 pmid: 28435844
[5]	刘俊杰 . SDN网络安全的研究与实现[D]. 南京:南京邮电大学, 2019.
[6]	SUN X, ANSARI N. EdgeIoT:Mobile edge computing for the Internet of Things[J]. IEEE Communications Magazine, 2016, 54,(12):22-29.
[7]	储轶钢 . 基于边缘智能的雾化物联网建设策略研究[J]. 电信技术, 2018(12):8-11.
[8]	黄颖祺, 张宏斌, 卢赓 , 等. 软件定义网络的安全问题及对策研究[J]. 信息安全研究, 2020,6(3):202-211.
	HUANG Yingqi, ZHANG Hongbin, LU Geng , et al. Security problem and countermeasure research of SDN[J]. Journal of Information Security Research, 2020,6(3):202-211.
[9]	石悦, 李相龙, 戴方芳 . 一种基于属性基加密的增强型软件定义网络安全框架[J]. 信息网络安全, 2018(1):15-22 .
	SHI Yue, LI Xianglong, DAI Fangfang . An enhanced security framework of software defined network based on attribute-based encryption[J]. Netinfo Security, 2018(1):15-22 .
[10]	朱梦迪 . 软件定义网络中控制信息一致性检测技术研究[D]. 合肥:安徽大学, 2020.
[11]	陈超, 王帅, 李智 , 等. SDN网络管理关键技术应用分析与改进思路[J].现代计算机, 2020(24):34-41.
	CHEN Chao, WANG Shuai, LI Zhi , et al. Application analysis and improvement of key technology of SDN network management[J]. Modern Computer, 2020(24):34-41.
[12]	YUE M, WANG H Y, LIU L , et al. Detecting DoS attacks based on multi-features in SDN[J]. IEEE Access, 2020,8:104688-104700.
[13]	王丽娜, 王斐, 刘维杰 . 面向SDN的安全威胁及其对抗技术研究[J]. 武汉大学学报(理学版), 2019,65(2):153-164.
	WANG Lina, WANG Fei, LIU Weijie . Researches on security threats and countermeasures of SDN[J]. Journal of Wuhan University(Natural Science Edition), 2019,65(2):153-164.
[14]	DARGAHI T, CAPONI A, AMBROSIN M , et al. A survey on the security of stateful SDN data planes[J]. IEEE Communications Surveys & Tutorials, 2017,19(3):1701-1725.
[15]	邵喆丹 . 软件定义网络安全保障若干关键技术研究[D]. 南京:南京邮电大学, 2019.
[16]	HUA J Y, ZHOU Z D, ZHONG S . Flow misleading:Worm-hole attack in software-defined networking via building in-band covert channel[J]. IEEE Transactions on Information Forensics and Security, 2020,16:1029-1043.
[17]	陈超 . SDN网络场景中的DDoS攻击检测方法与缓解机制的研究[D]. 南京:南京邮电大学, 2018.
[18]	谢宗晓, 董坤祥, 甄杰 . 公钥基础设施(PKI)的发展过程及其架构[J]. 中国质量与标准导报, 2020(5):17-20.
	XIE Zongxiao, DONG Kunxiang, ZHEN Jie . The development of public key infrastructure(PKI) and its architecture[J]. China Quality and Standards Review, 2020(5):17-20.
[19]	EOM T, HONG J B, AN S , et al. A systematic approach to threat modeling and security analysis for software defined networking[J]. IEEE Access, 2019,7:137432-137445. doi: 10.1109/Access.6287639
[20]	LI S F, CUI Y H, NI Y F , et al. An effective SDN controller scheduling method to defence DDoS attacks[J]. Chinese Journal of Electronics, 2019,28(2):404-407. doi: 10.1049/cje.v28.2
[21]	YOON S, CHO J H, KIM D S D, et al. Attack graph-based moving target defense in software-defined networks[J]. IEEE Transactions on Network and Service Management, 2020,17(3):1653-1668. doi: 10.1109/TNSM.4275028
[22]	刘江 . 网络动态防御策略及其有效性评估研究[D]. 郑州:解放军信息工程大学, 2017.
[23]	KALKAN K, ALTAY L, GÜR G, et al. JESS:Joint entropy-based DDoS defense scheme in SDN[J]. IEEE Journal on Selected Areas in Communications, 2018,36(10):2358-2372. doi: 10.1109/JSAC.2018.2869997
[24]	尹胜 . SDN网络中入侵行为识别与检测研究[D]. 西安:西安科技大学, 2020.

安全风险	描述
欺骗	攻击者通过伪装成SDN控制器来获取用户的数据或服务逻辑,并将其用于后续攻击
抵赖	用户可能会否认他实施过的恶意网络策略,例如复制特定流量并将其转发到恶意服务器
信息泄露	攻击者可伪装成合法用户,通过SDN应用程序向网络注入伪造的流量
应用程序漏洞	SDN应用程序漏洞（如代码缺陷和不安全代码）可被攻击者利用以访问资源^[10]